You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by "Fang, Wen Yan" <we...@siemens-healthineers.com> on 2024/06/21 02:52:03 UTC
Failed SSO login attempt for invalid database user does not redirect to login screen
Hi all,
I'm using openid combined with mysql database, and I have setup restricting authentication to database users only. I find that if an SSO user does not exist in the database or login is disabled will be redirected to the login screen, but if the user is invalid for example outside of "enable account after" hours will not be redirected to login screen but instead a blank page. Is there any way to fix this?
Thanks!
Re: Failed SSO login attempt for invalid database user does not redirect to login screen
Posted by Michael Jumper <mj...@apache.org>.
The authentication system does not actually have a login screen per se.
What you see as a login screen is the result of the web application
processing the response from that ".../api/tokens" endpoint. There's no
redirect, but rather information about additional authentication
challenges that must be satisfied before the user may log in.
I suspect the issue here is similar to what we encountered with
combining TOTP with SAML or with the new version of Duo's SDK, where the
nature of the third-party redirect means that some of that
authentication context was lost. Lacking that context, the UI just
doesn't know how to render the error.
I think the part of the UI that handles these authentication responses
just needs to be modified to be able to render the reported error even
when the information describing the required credentials is no longer
available, maybe in a similar fashion to the "re-login" message
displayed after logout.
- Mike
On 6/27/24 7:20 PM, Fang, Wen Yan wrote:
> 02:19:39.721 [http-nio-8080-exec-8] DEBUG o.a.g.rest.RESTExceptionMapper
> - Client request rejected: User account is no longer valid.
>
> 02:19:46.428 [pool-1-thread-1] DEBUG o.a.g.rest.auth.HashTokenSessionMap
> - Checking for expired sessions...
>
> 02:19:46.428 [pool-1-thread-1] DEBUG o.a.g.rest.auth.HashTokenSessionMap
> - Session check completed in 0 ms.
>
> It does reject the attempt, but it does not redirect user back to login
> screen or display any visible error message.
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
RE: Failed SSO login attempt for invalid database user does not redirect to login screen
Posted by "Fang, Wen Yan" <we...@siemens-healthineers.com>.
02:19:39.721 [http-nio-8080-exec-8] DEBUG o.a.g.rest.RESTExceptionMapper - Client request rejected: User account is no longer valid.
02:19:46.428 [pool-1-thread-1] DEBUG o.a.g.rest.auth.HashTokenSessionMap - Checking for expired sessions...
02:19:46.428 [pool-1-thread-1] DEBUG o.a.g.rest.auth.HashTokenSessionMap - Session check completed in 0 ms.
It does reject the attempt, but it does not redirect user back to login screen or display any visible error message.
Re: Failed SSO login attempt for invalid database user does not redirect to login screen
Posted by Nick Couchman <vn...@apache.org>.
On Sun, Jun 23, 2024 at 9:23 PM Fang, Wen Yan <
wenyan.fang@siemens-healthineers.com> wrote:
> Hi Nick,
>
>
>
> I’m using 1.5.5 in docker. There is only one error returned by console.
>
>
>
> POST https://example.com/guacamole/api/tokens 400 (Bad Request)
>
>
>
What do your container logs say at the time that this error occurs?
-Nick
>
RE: Failed SSO login attempt for invalid database user does not redirect to login screen
Posted by "Fang, Wen Yan" <we...@siemens-healthineers.com>.
Hi Nick,
I’m using 1.5.5 in docker. There is only one error returned by console.
POST https://example.com/guacamole/api/tokens 400 (Bad Request)
From: Nick Couchman <vn...@apache.org>
Sent: Saturday, June 22, 2024 12:02 AM
To: user@guacamole.apache.org
Subject: Re: Failed SSO login attempt for invalid database user does not redirect to login screen
You don't often get email from vnick@apache.org<ma...@apache.org>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
On Thu, Jun 20, 2024 at 10:52 PM Fang, Wen Yan <we...@siemens-healthineers.com>> wrote:
Hi all,
I’m using openid combined with mysql database, and I have setup restricting authentication to database users only. I find that if an SSO user does not exist in the database or login is disabled will be redirected to the login screen, but if the user is invalid for example outside of “enable account after” hours will not be redirected to login screen but instead a blank page. Is there any way to fix this?
What version of Guacamole are you running?
When you get redirected to the blank page, are there any messages in the local JavaScript console, or your Tomcat logs, that indicate any errors?
-Nick
Re: Failed SSO login attempt for invalid database user does not redirect to login screen
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Jun 20, 2024 at 10:52 PM Fang, Wen Yan <
wenyan.fang@siemens-healthineers.com> wrote:
> Hi all,
>
>
>
> I’m using openid combined with mysql database, and I have setup
> restricting authentication to database users only. I find that if an SSO
> user does not exist in the database or login is disabled will be redirected
> to the login screen, but if the user is invalid for example outside of
> “enable account after” hours will not be redirected to login screen but
> instead a blank page. Is there any way to fix this?
>
>
>
What version of Guacamole are you running?
When you get redirected to the blank page, are there any messages in the
local JavaScript console, or your Tomcat logs, that indicate any errors?
-Nick
>